After the modification of test_761.c, the test no longer contains a vulnerability. See the develop branch, commit b603085.
The second test part is as follows.
contains_char('T');
The function searches the string Search! for the character T, which will not be found. Although the index i is incremented, the pointer str itself is never manipulated. Because the letter T is not found, the string str is freed on line 39. When this occurs, str still points to the beginning of the character buffer, meaning the correct address is freed.
FREE(str);
To contain a vulnerability, the test would need to either increment the pointer (str = str + 1), as was previously done in contains_char_malicious(), or free str[i].
After the modification of
test_761.c
, the test no longer contains a vulnerability. See thedevelop
branch, commit b603085.The second test part is as follows.
The function searches the string
Search!
for the characterT
, which will not be found. Although the indexi
is incremented, the pointerstr
itself is never manipulated. Because the letterT
is not found, the stringstr
is freed on line 39. When this occurs,str
still points to the beginning of the character buffer, meaning the correct address is freed.To contain a vulnerability, the test would need to either increment the pointer (
str = str + 1
), as was previously done incontains_char_malicious()
, or freestr[i]
.FYI @austinhroach.